> For the complete documentation index, see [llms.txt](https://docs.1kosmos.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/liveid-selfie.md). # LiveID Selfie Configure LiveID Selfie with Push Notification for Windows login in 1Kosmos. Authenticate using facial biometrics and 1Kosmos app approval. Users provide a live selfie on a camera-enabled device at the Windows login screen. Facial recognition and liveness detection verify the user is physically present. No password is required when LiveID Selfie is configured as the sole authentication method.
### Admin Setup #### Configure the Authentication Journey 1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**. 2. Create a new journey or edit an existing one. 3. Under **Authentication Method**, select **LiveID Selfie**. 4. To use LiveID Selfie as the sole authentication factor (passwordless), select **LiveID Selfie only**. To combine with a password, select **Password & LiveID Selfie**. 5. When LiveID Selfie is configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration. 6. Assign the journey to the target user group or machine policy. 7. Save and publish the journey. #### Auth Type Configuration You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the `authType`. This also controls PIN prompts based on whether the device is trusted. | Value | Description | | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------- | | `none` | Users are never prompted for a PIN. | | `pin` | Users are always prompted for a PIN. | | `auto` | Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie. | ### User Guide #### Login from the User Tile 1. At the Windows login screen, click the **1Kosmos tile**. 2. Select **LiveID Selfie** from the available authentication options. 3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically. 4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**. 5. After successful authentication, you are logged into the workstation. {% hint style="info" %} If you selected **Trust this device**, subsequent logins from this device require only the selfie — no PIN prompt. {% endhint %} #### Login from the Other User Tile 1. At the Windows login screen, click **Other User**. 2. Enter your Windows username and press **Enter**. 3. Select **LiveID Selfie** from the available authentication options. 4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically. 5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**. 6. After successful authentication, you are logged into the workstation. *** ## LiveID Selfie & Push Notification Users provide a live selfie on a camera-enabled device and approve the sign-in request via the 1Kosmos mobile app. No password is required when LiveID Selfie & Push Notification is configured as the sole authentication method. ### Admin Setup #### Configure the Authentication Journey 1. In AdminX, navigate to **Applications > Windows MFA > Adaptive Auth Journeys**. 2. Create a new journey or edit an existing one. 3. Under **Authentication Method**, select **LiveID Selfie & Push Notification**. 4. To use this as the sole authentication factor (passwordless), select **LiveID Selfie & Push Notification only**. To combine with a password, select **Password & LiveID Selfie & Push Notification**. 5. When configured as the sole factor, users are not prompted for a password at any point in the login flow. Ensure your organisation's security policy permits passwordless authentication before enabling this configuration. 6. Assign the journey to the target user group or machine policy. 7. Save and publish the journey. #### Auth Type Configuration You can configure how the user is prompted for a PIN after a LiveID Selfie capture by setting the `authType`. This also controls PIN prompts based on whether the device is trusted. | Value | Description | | ------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `none` | Users are never prompted for a PIN. | | `pin` | Users are always prompted for a PIN. | | `auto` | Users are prompted for a PIN only on new devices or untrusted devices. Once a device is marked as trusted, subsequent logins require only the selfie and push approval. | ### User Guide #### Login from the User Tile 1. At the Windows login screen, click the **1Kosmos tile**. 2. Select **LiveID Selfie** from the available authentication options. 3. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically. 4. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**. 5. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request. 6. After successful authentication, you are logged into the workstation. {% hint style="info" %} If you selected **Trust this device**, subsequent logins from this device require only the selfie and push approval no PIN prompt. {% endhint %} #### Login from the Other User Tile 1. At the Windows login screen, click **Other User**. 2. Enter your Windows username and press **Enter**. 3. Select **LiveID Selfie** from the available authentication options. 4. Position your face within the oval shown on the screen. When aligned properly, the selfie is captured automatically. 5. Enter your LiveID Selfie PIN. To skip the PIN prompt on future logins from this device, select **Trust this device**. 6. A push notification is sent to your 1Kosmos mobile app. Open the app and approve the sign-in request. 7. After successful authentication, you are logged into the workstation. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.1kosmos.com/authentication/windows-workstation-mfa/authentication-methods/liveid-selfie.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.